Try SpotterConfigure NGFW IPv4/IPv6 application policies.
| "added in version" 2.1.0 of fortinet.fortimanager"
Authors: Xinwei Du (@dux-fortinet), Xing Li (@lix-fortinet), Jie Xue (@JieX19), Link Zheng (@chillancezen), Frank Shen (@fshen01), Hongbin Lu (@fgtdev-hblu)
preview | supported by community
Install with ansible-galaxy collection install fortinet.fortimanager:==2.4.0
collections:
- name: fortinet.fortimanager
version: 2.4.0This module is able to configure a FortiManager device.
Examples include all parameters and values which need to be adjusted to data sources before usage.
- name: Example playbook (generated based on argument schema)
hosts: fortimanagers
connection: httpapi
vars:
ansible_httpapi_use_ssl: true
ansible_httpapi_validate_certs: false
ansible_httpapi_port: 443
tasks:
- name: Configure NGFW IPv4/IPv6 application policies.
fortinet.fortimanager.fmgr_pm_config_pblock_firewall_securitypolicy:
# bypass_validation: false
workspace_locking_adom: <value in [global, custom adom including root]>
workspace_locking_timeout: 300
# rc_succeeded: [0, -2, -3, ...]
# rc_failed: [-2, -3, ...]
adom: <your own value>
pblock: <your own value>
state: present # <value in [present, absent]>
pm_config_pblock_firewall_securitypolicy:
_policy_block: <integer>
action: <value in [deny, accept]>
app_category: <list or string>
app_group: <list or string>
application: <list or integer>
application_list: <string>
av_profile: <string>
cifs_profile: <string>
comments: <string>
dlp_profile: <string>
dnsfilter_profile: <string>
dstaddr: <list or string>
dstaddr_negate: <value in [disable, enable]>
dstaddr6: <list or string>
dstintf: <list or string>
emailfilter_profile: <string>
enforce_default_app_port: <value in [disable, enable]>
file_filter_profile: <string>
fsso_groups: <list or string>
global_label: <string>
groups: <list or string>
icap_profile: <string>
internet_service: <value in [disable, enable]>
internet_service_custom: <list or string>
internet_service_custom_group: <list or string>
internet_service_group: <list or string>
internet_service_name: <list or string>
internet_service_negate: <value in [disable, enable]>
internet_service_src: <value in [disable, enable]>
internet_service_src_custom: <list or string>
internet_service_src_custom_group: <list or string>
internet_service_src_group: <list or string>
internet_service_src_name: <list or string>
internet_service_src_negate: <value in [disable, enable]>
ips_sensor: <string>
learning_mode: <value in [disable, enable]>
logtraffic: <value in [disable, all, utm]>
name: <string>
nat46: <value in [disable, enable]>
nat64: <value in [disable, enable]>
policyid: <integer>
profile_group: <string>
profile_protocol_options: <string>
profile_type: <value in [single, group]>
schedule: <string>
sctp_filter_profile: <string>
send_deny_packet: <value in [disable, enable]>
service: <list or string>
service_negate: <value in [disable, enable]>
srcaddr: <list or string>
srcaddr_negate: <value in [disable, enable]>
srcaddr6: <list or string>
srcintf: <list or string>
ssh_filter_profile: <string>
ssl_ssh_profile: <string>
status: <value in [disable, enable]>
url_category: <list or string>
users: <list or string>
utm_status: <value in [disable, enable]>
uuid: <string>
videofilter_profile: <string>
voip_profile: <string>
webfilter_profile: <string>
dlp_sensor: <string>
mms_profile: <string>
internet_service_id: <list or string>
logtraffic_start: <value in [disable, enable]>
srcaddr4: <list or string>
dstaddr4: <list or string>
internet_service_src_id: <list or string>
internet_service6: <value in [disable, enable]>
internet_service6_custom: <list or string>
internet_service6_custom_group: <list or string>
internet_service6_group: <list or string>
internet_service6_name: <list or string>
internet_service6_negate: <value in [disable, enable]>
internet_service6_src: <value in [disable, enable]>
internet_service6_src_custom: <list or string>
internet_service6_src_custom_group: <list or string>
internet_service6_src_group: <list or string>
internet_service6_src_name: <list or string>
internet_service6_src_negate: <value in [disable, enable]>
casb_profile: <string>
diameter_filter_profile: <string>
dstaddr6_negate: <value in [disable, enable]>
ips_voip_filter: <string>
srcaddr6_negate: <value in [disable, enable]>
virtual_patch_profile: <string>
adom:
description: The parameter (adom) in requested url.
required: true
type: str
state:
choices:
- present
- absent
description: The directive to create, update or delete an object.
required: true
type: str
pblock:
description: The parameter (pblock) in requested url.
required: true
type: str
rc_failed:
description: The rc codes list with which the conditions to fail will be overriden.
elements: int
type: list
enable_log:
default: false
description: Enable/Disable logging for task.
type: bool
access_token:
description: The token to access FortiManager without using username and password.
type: str
rc_succeeded:
description: The rc codes list with which the conditions to succeed will be overriden.
elements: int
type: list
proposed_method:
choices:
- update
- set
- add
description: The overridden method for the underlying Json RPC request.
type: str
bypass_validation:
default: false
description: Only set to True when module schema diffs with FortiManager API structure,
module continues to execute without validating parameters.
type: bool
workspace_locking_adom:
description: The adom to lock for FortiManager running in workspace mode, the value
can be global and others including root.
type: str
forticloud_access_token:
description: Authenticate Ansible client with forticloud API access token.
type: str
workspace_locking_timeout:
default: 300
description: The maximum time in seconds to wait for other user to release the workspace
lock.
type: int
pm_config_pblock_firewall_securitypolicy:
description: The top level parameters set.
required: false
suboptions:
_policy_block:
description: Assigned policy block.
type: int
action:
choices:
- deny
- accept
description: Policy action
type: str
app-category:
description: (list) Deprecated, please rename it to app_category.
type: raw
app-group:
description: (list) Deprecated, please rename it to app_group.
type: raw
application:
description: (list) No description.
type: raw
application-list:
description: Deprecated, please rename it to application_list. Name of an existing
Application list.
type: str
av-profile:
description: Deprecated, please rename it to av_profile. Name of an existing Antivirus
profile.
type: str
casb-profile:
description: Deprecated, please rename it to casb_profile. Name of an existing
CASB profile.
type: str
cifs-profile:
description: Deprecated, please rename it to cifs_profile. Name of an existing
CIFS profile.
type: str
comments:
description: Comment.
type: str
diameter-filter-profile:
description: Deprecated, please rename it to diameter_filter_profile. Name of
an existing Diameter filter profile.
type: str
dlp-profile:
description: Deprecated, please rename it to dlp_profile. Name of an existing
DLP profile.
type: str
dlp-sensor:
description: Deprecated, please rename it to dlp_sensor. Name of an existing DLP
sensor.
type: str
dnsfilter-profile:
description: Deprecated, please rename it to dnsfilter_profile. Name of an existing
DNS filter profile.
type: str
dstaddr:
description: (list) No description.
type: raw
dstaddr-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to dstaddr_negate. When enabled dstaddr/dstaddr6
specifies what the destination address must ...
type: str
dstaddr4:
description: (list) No description.
type: raw
dstaddr6:
description: (list) No description.
type: raw
dstaddr6-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to dstaddr6_negate. When enabled dstaddr6
specifies what the destination address must NOT be.
type: str
dstintf:
description: (list) No description.
type: raw
emailfilter-profile:
description: Deprecated, please rename it to emailfilter_profile. Name of an existing
email filter profile.
type: str
enforce-default-app-port:
choices:
- disable
- enable
description: Deprecated, please rename it to enforce_default_app_port. Enable/disable
default application port enforcement for allowed ...
type: str
file-filter-profile:
description: Deprecated, please rename it to file_filter_profile. Name of an existing
file-filter profile.
type: str
fsso-groups:
description: (list) Deprecated, please rename it to fsso_groups.
type: raw
global-label:
description: Deprecated, please rename it to global_label. Label for the policy
that appears when the GUI is in Global View mode.
type: str
groups:
description: (list) No description.
type: raw
icap-profile:
description: Deprecated, please rename it to icap_profile. Name of an existing
ICAP profile.
type: str
internet-service:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service. Enable/disable
use of Internet Services for this policy.
type: str
internet-service-custom:
description: (list) Deprecated, please rename it to internet_service_custom.
type: raw
internet-service-custom-group:
description: (list) Deprecated, please rename it to internet_service_custom_group.
type: raw
internet-service-group:
description: (list) Deprecated, please rename it to internet_service_group.
type: raw
internet-service-id:
description: (list) Deprecated, please rename it to internet_service_id.
type: raw
internet-service-name:
description: (list) Deprecated, please rename it to internet_service_name.
type: raw
internet-service-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service_negate. When enabled
internet-service specifies what the service must NOT be.
type: str
internet-service-src:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service_src. Enable/disable
use of Internet Services in source for this policy.
type: str
internet-service-src-custom:
description: (list) Deprecated, please rename it to internet_service_src_custom.
type: raw
internet-service-src-custom-group:
description: (list) Deprecated, please rename it to internet_service_src_custom_group.
type: raw
internet-service-src-group:
description: (list) Deprecated, please rename it to internet_service_src_group.
type: raw
internet-service-src-id:
description: (list) Deprecated, please rename it to internet_service_src_id.
type: raw
internet-service-src-name:
description: (list) Deprecated, please rename it to internet_service_src_name.
type: raw
internet-service-src-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service_src_negate. When
enabled internet-service-src specifies what the service ...
type: str
internet-service6:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6. Enable/disable
use of IPv6 Internet Services for this policy.
type: str
internet-service6-custom:
description: (list) Deprecated, please rename it to internet_service6_custom.
type: raw
internet-service6-custom-group:
description: (list) Deprecated, please rename it to internet_service6_custom_group.
type: raw
internet-service6-group:
description: (list) Deprecated, please rename it to internet_service6_group.
type: raw
internet-service6-name:
description: (list) Deprecated, please rename it to internet_service6_name.
type: raw
internet-service6-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6_negate. When enabled
internet-service6 specifies what the service must N...
type: str
internet-service6-src:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6_src. Enable/disable
use of IPv6 Internet Services in source for this policy.
type: str
internet-service6-src-custom:
description: (list) Deprecated, please rename it to internet_service6_src_custom.
type: raw
internet-service6-src-custom-group:
description: (list) Deprecated, please rename it to internet_service6_src_custom_group.
type: raw
internet-service6-src-group:
description: (list) Deprecated, please rename it to internet_service6_src_group.
type: raw
internet-service6-src-name:
description: (list) Deprecated, please rename it to internet_service6_src_name.
type: raw
internet-service6-src-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to internet_service6_src_negate. When
enabled internet-service6-src specifies what the servic...
type: str
ips-sensor:
description: Deprecated, please rename it to ips_sensor. Name of an existing IPS
sensor.
type: str
ips-voip-filter:
description: Deprecated, please rename it to ips_voip_filter. Name of an existing
VoIP
type: str
learning-mode:
choices:
- disable
- enable
description: Deprecated, please rename it to learning_mode. Enable to allow everything,
but log all of the meaningful data for security...
type: str
logtraffic:
choices:
- disable
- all
- utm
description: Enable or disable logging.
type: str
logtraffic-start:
choices:
- disable
- enable
description: Deprecated, please rename it to logtraffic_start. Record logs when
a session starts.
type: str
mms-profile:
description: Deprecated, please rename it to mms_profile. Name of an existing
MMS profile.
type: str
name:
description: Policy name.
type: str
nat46:
choices:
- disable
- enable
description: Enable/disable NAT46.
type: str
nat64:
choices:
- disable
- enable
description: Enable/disable NAT64.
type: str
policyid:
description: Policy ID.
required: true
type: int
profile-group:
description: Deprecated, please rename it to profile_group. Name of profile group.
type: str
profile-protocol-options:
description: Deprecated, please rename it to profile_protocol_options. Name of
an existing Protocol options profile.
type: str
profile-type:
choices:
- single
- group
description: Deprecated, please rename it to profile_type. Determine whether the
firewall policy allows security profile groups or sing...
type: str
schedule:
description: Schedule name.
type: str
sctp-filter-profile:
description: Deprecated, please rename it to sctp_filter_profile. Name of an existing
SCTP filter profile.
type: str
send-deny-packet:
choices:
- disable
- enable
description: Deprecated, please rename it to send_deny_packet. Enable to send
a reply when a session is denied or blocked by a firewall...
type: str
service:
description: (list) No description.
type: raw
service-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to service_negate. When enabled service
specifies what the service must NOT be.
type: str
srcaddr:
description: (list) No description.
type: raw
srcaddr-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to srcaddr_negate. When enabled srcaddr/srcaddr6
specifies what the source address must NOT be.
type: str
srcaddr4:
description: (list) No description.
type: raw
srcaddr6:
description: (list) No description.
type: raw
srcaddr6-negate:
choices:
- disable
- enable
description: Deprecated, please rename it to srcaddr6_negate. When enabled srcaddr6
specifies what the source address must NOT be.
type: str
srcintf:
description: (list) No description.
type: raw
ssh-filter-profile:
description: Deprecated, please rename it to ssh_filter_profile. Name of an existing
SSH filter profile.
type: str
ssl-ssh-profile:
description: Deprecated, please rename it to ssl_ssh_profile. Name of an existing
SSL SSH profile.
type: str
status:
choices:
- disable
- enable
description: Enable or disable this policy.
type: str
url-category:
description: (list) Deprecated, please rename it to url_category.
type: raw
users:
description: (list) No description.
type: raw
utm-status:
choices:
- disable
- enable
description: Deprecated, please rename it to utm_status. Enable security profiles.
type: str
uuid:
description: Universally Unique Identifier
type: str
videofilter-profile:
description: Deprecated, please rename it to videofilter_profile. Name of an existing
VideoFilter profile.
type: str
virtual-patch-profile:
description: Deprecated, please rename it to virtual_patch_profile. Name of an
existing virtual-patch profile.
type: str
voip-profile:
description: Deprecated, please rename it to voip_profile. Name of an existing
VoIP profile.
type: str
webfilter-profile:
description: Deprecated, please rename it to webfilter_profile. Name of an existing
Web filter profile.
type: str
type: dict
meta:
contains:
request_url:
description: The full url requested.
returned: always
sample: /sys/login/user
type: str
response_code:
description: The status of api request.
returned: always
sample: 0
type: int
response_data:
description: The api response.
returned: always
type: list
response_message:
description: The descriptive message of the api response.
returned: always
sample: OK.
type: str
system_information:
description: The information of the target system.
returned: always
type: dict
description: The result of the request.
returned: always
type: dict
rc:
description: The status the request.
returned: always
sample: 0
type: int
version_check_warning:
description: Warning if the parameters used in the playbook are not supported by
the current FortiManager version.
returned: complex
type: list